-
Notifications
You must be signed in to change notification settings - Fork 162
Closed as not planned
Closed as not planned
Copy link
Description
Bug Description
In rpc/namespaces/ethereum/eth/filters/filters.go, the Logs() function checks the log limit only AFTER calling blockLogs():
filtered, err := f.blockLogs(blockRes, bloom)
// ... error handling ...
if len(logs)+len(filtered) > logLimit {
return nil, fmt.Errorf("query returned more than %d results", logLimit)
}blockLogs() materializes ALL matching logs from a single block into memory before the limit is checked.
Reproduction
- Deploy a cosmos/evm chain with a public RPC endpoint
- Have a block with many log-emitting transactions (e.g., 100k+ event logs)
- Call
eth_getLogswith a filter matching that block - The RPC node allocates all logs into memory before checking the limit
- Node runs out of memory and crashes
Impact
Any public RPC endpoint running cosmos/evm is vulnerable to OOM crash via a single eth_getLogs call. An attacker only needs to know a log-heavy block number.
Proposed Fix
Add an early guard checking len(logs) >= logLimit BEFORE calling blockLogs() for each block iteration:
if logLimit > 0 && len(logs) >= logLimit {
break
}Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels